678d Privacy Policy —
How We Protect Your Data

678d operates the online casino and sports betting platform accessible at 678d.io. For the purposes of this Privacy Policy, 678d is the data controller responsible for the personal information collected through the Platform.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data we hold about you, please contact our dedicated support team:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 inside the Platform after logging in
• Support Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)

When contacting us about a data-related request, please include your registered account username and a clear description of your request so that our team can respond efficiently.

678d collects personal data through several channels: directly from you when you register an account or contact support, automatically when you use the Platform, and from third-party payment processors and identity verification services where necessary. The categories of personal data we collect are as follows:

Registration and Account Data:

• Full legal name
• Date of birth (used to verify the 21+ age requirement)
• Residential address, including city (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi)
• Email address
• Mobile phone number (used for account authentication and support communications)
• Username and encrypted password hash

Identity Verification (KYC) Data:

• Government-issued photo identification: National Identity Card (NID), passport, or driving licence
• Proof of payment method ownership (e.g., bKash or Nagad account screenshot showing matching account holder name)
• Selfie or liveness-check image where required for enhanced verification

Financial and Transaction Data:

• Deposit and withdrawal amounts and timestamps
• Payment method identifiers (e.g., registered bKash or Nagad mobile number, last four digits of card number)
• Transaction reference numbers
• Account balance history

Gaming Activity Data:

• Games played, bet amounts, win/loss records, and session durations
• Sports betting market selections and odds accepted
• Bonus and promotion usage history
• Responsible gaming settings you have configured (deposit limits, self-exclusion status)

Technical and Usage Data:

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser type
• Session start/end times and page interaction logs
• Cookies and similar tracking technologies (see Section 7 for full details)

Communications Data:

• Content of support tickets, live chat transcripts, and emails exchanged with 678d support
• Survey responses and feedback submissions (where voluntarily provided)

678d processes personal data only where there is a defined purpose and a legitimate basis for doing so. The table below maps each processing activity to its purpose and legal basis:

Where processing is based on your consent (for example, receiving promotional communications), you have the right to withdraw that consent at any time by contacting support or adjusting your account notification preferences. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

678d does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. We share personal data only in the following limited and controlled circumstances:

Payment Processors: When you make a deposit or withdrawal, necessary transaction data (such as your registered mobile number or card details) is shared with the relevant payment service provider — bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, or Mastercard. These providers process payments under their own privacy policies and applicable financial regulations.

Identity Verification Providers: KYC document submissions may be processed by third-party identity verification services that compare your submitted documents against official records. These providers are contractually bound to use your data solely for identity verification purposes and to maintain appropriate security standards.

Game Software Providers: Your player account identifier and gaming session data are shared with game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi to the extent necessary to deliver the game you are playing and to resolve disputes. Full personal identification details are not shared with game providers.

Fraud Prevention and Security Partners: Aggregated or pseudonymised data may be shared with fraud detection platforms to identify patterns of abuse across the industry. This data is anonymised where possible and is never used to identify you to third parties.

Legal and Regulatory Disclosures: 678d may be required to disclose personal data to law enforcement agencies, regulatory bodies, or courts in response to a lawful request, court order, or legal obligation. We will notify you of any such disclosure where legally permitted to do so.

Business Transfers: In the event that 678d undergoes a merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity. You will be notified of any such transfer and of any changes to this Privacy Policy that arise as a result.

All third parties with whom 678d shares personal data are required under contract to maintain appropriate technical and organisational security measures and to use the data only for the specified purpose.

678d retains personal data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and registration data: Retained for the duration of your account and for a minimum of 5 years following account closure, to comply with anti-money laundering record-keeping obligations.
• KYC documents: Retained for a minimum of 5 years from the date of verification, in accordance with AML best practices.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction.
• Gaming activity logs: Retained for a minimum of 3 years from the date of each gaming session, or longer if required for dispute resolution.
• Support communications: Retained for 2 years from the date of the last interaction, unless the communication relates to an open dispute or legal matter, in which case it is retained until resolution.
• Technical and usage data (cookies, IP logs): Retained for up to 13 months from collection, after which it is aggregated or deleted.

When retention periods expire, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Where anonymisation is not technically feasible, data is pseudonymised and access is restricted.

678d implements a layered security architecture to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Key security measures in place include:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or mobile device and the 678d Platform is encrypted in transit using TLS 1.2 or higher. This prevents interception of data in transit.
• Encrypted Database Storage: Sensitive personal data fields (including identity document references and payment identifiers) are stored using AES-256 encryption at rest.
• Password Security: Passwords are never stored in plaintext. 678d uses a cryptographic hashing algorithm with per-user salting to ensure that even in the event of a data breach, passwords cannot be reversed.
• Access Controls: Access to personal data is restricted to 678d personnel who require it to perform their job functions. All internal access is logged and audited. Employees undergo regular data protection training.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their 678d accounts for an additional layer of login security.
• Penetration Testing and Security Audits: 678d conducts regular security assessments to identify and remediate vulnerabilities in its infrastructure and application code.
• Incident Response: 678d maintains a documented data breach response procedure. In the event of a security incident affecting your personal data, 678d will notify affected players within a reasonable timeframe and take immediate steps to contain the breach.

While 678d takes all reasonable precautions to protect your data, no system can guarantee absolute security. You are responsible for keeping your own login credentials confidential and for notifying us immediately if you suspect any unauthorised access to your account.

678d uses cookies and similar tracking technologies to provide a functional, personalised, and secure experience on the Platform. A cookie is a small text file placed on your device by a website. The following categories of cookies are used:

Strictly Necessary Cookies: These cookies are essential for the Platform to function and cannot be disabled without breaking core functionality. They include session authentication tokens, CSRF protection tokens, and load-balancing cookies. No personal browsing data is transmitted to third parties through these cookies.

Functional Cookies: These cookies remember your preferences such as your preferred language display, game lobby layout settings, and responsible gaming reminder intervals. They improve your experience but are not essential for basic Platform operation.

Analytics Cookies:678d uses first-party analytics to understand how players interact with the Platform — which sections are most visited, where users encounter errors, and how navigation flows are used. This data is collected in aggregate and pseudonymised form. It is used exclusively to improve the Platform and is not shared with advertising networks.

Session and Security Cookies: These cookies manage your logged-in session, enforce session timeouts after periods of inactivity, and help detect suspicious login attempts from unrecognised devices or locations.

You can control cookie settings through your browser's privacy settings. Disabling strictly necessary cookies will prevent you from logging in to or using the Platform. Disabling functional or analytics cookies will not prevent you from accessing the Platform but may affect your experience.

678d does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts on the Platform.

As a 678d player, you hold the following rights in respect of your personal data. To exercise any of these rights, contact support at [email protected]. 678d will respond to all data rights requests within 30 days of receipt.

• Right of Access: You may request a copy of the personal data that 678d holds about you, including the categories of data, the purposes for which it is processed, and the recipients with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update many account details directly from within your account dashboard.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where you object to processing based on legitimate interests. Note that this right is subject to overriding legal retention obligations (e.g., AML record-keeping requirements).
• Right to Restriction of Processing: In certain circumstances (for example, while a dispute is under review), you may request that 678d restricts its processing of your personal data to storage only, pending resolution.
• Right to Data Portability: You may request your personal data in a structured, commonly used, and machine-readable format (such as JSON or CSV) to transfer to another service provider, where technically feasible.
• Right to Object: Where processing is based on legitimate interests, you have the right to object. 678d will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on consent (for example, receiving promotional emails), you may withdraw consent at any time without affecting the lawfulness of prior processing.

678d will not charge a fee for handling data rights requests made in good faith. If a request is manifestly unfounded or excessive, 678d reserves the right to charge a reasonable administrative fee or decline the request, with written reasons provided.

The 678d Platform is strictly intended for adults aged 21 years and above. 678d does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process precisely to ensure compliance with this requirement.

If 678d becomes aware that personal data has been collected from a person under 21 years of age, the account will be suspended immediately, all associated bets will be voided, and all personal data collected will be deleted from our systems as promptly as technically possible.

If you are a parent or guardian and believe that a minor in your care has registered a 678d account, please contact us immediately at [email protected] with the relevant account details so that we can take prompt action.

678d's primary operations are focused on the Bangladesh market, and player data is handled with Bangladesh-based players in mind. However, certain third-party service providers that 678d uses — such as game software platforms (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Ezugi) and infrastructure providers — may process data on servers located outside Bangladesh.

Where personal data is transferred to or processed in a jurisdiction outside Bangladesh, 678d takes reasonable steps to ensure that an adequate level of protection is applied, including:

• Using service providers that are contractually bound by data processing agreements incorporating appropriate data protection obligations.
• Preferring providers that operate under internationally recognised security certification frameworks.
• Limiting the scope of data transferred to the minimum necessary for the service being provided.

If you have questions about the specific international transfers applicable to your data, please contact support at [email protected].

The 678d Platform may contain references to third-party game providers, payment partners, or other services. These references do not constitute external hyperlinks within the Platform UI, but where game providers or payment processors operate their own interfaces (for example, a payment gateway redirect), those services are governed by their own privacy policies.

678d is not responsible for the privacy practices of third-party services accessed through the payment or game provider flow. We encourage you to review the privacy policy of any third-party service you interact with during your 678d experience.

678d reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, 678d will notify registered players by one or more of the following methods:

• A prominent notice displayed upon your next login to the Platform
• An email notification sent to your registered account email address
• A notice on the 678d homepage

The "Effective Date" at the top of this policy reflects the date on which the current version came into force. Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acknowledgment of the updated terms.

If you do not agree with a material change to this Privacy Policy, you should cease using the Platform and may request account closure by contacting [email protected]. Upon voluntary closure, your verified real-money balance will be returned to your registered payment method, and your personal data will be retained only for the minimum period required by law.

The most current version of this Privacy Policy is always available at 678d.io/privacy-policy.